{"data":{"id":"7dc5638c-9014-4db7-bb05-09280d7a3939","title":"GHSA-m4rf-3fr8-xwx3: NLTK: JVM argument injection bypass via per-call options in the NLTK Stanford wrappers (incomplete fix of CVE-2026-12841)","summary":"NLTK's Stanford wrapper classes have a security vulnerability where the `java_options` parameter bypasses validation that was supposed to block dangerous JVM (Java Virtual Machine, the software that runs Java programs) flags like `-agentpath` and `-javaagent`. While a previous fix added validation through the `config_java()` function, the per-call `options` parameter in the `java()` function skips this validation entirely, allowing attackers to inject malicious JVM arguments and execute arbitrary code.","solution":"N/A -- no mitigation discussed in source.","labels":["security"],"sourceUrl":"https://github.com/advisories/GHSA-m4rf-3fr8-xwx3","publishedAt":"2026-09-01T20:38:22.000Z","cveId":"CVE-2026-79675","cweIds":null,"cvssScore":null,"cvssSeverity":"critical","severity":"critical","attackType":["supply_chain"],"issueType":"vulnerability","affectedPackages":["nltk@<= 3.10.2 (fixed: 3.10.3)"],"affectedVendors":["HuggingFace"],"affectedVendorsRaw":["NLTK","Stanford NLP"],"classifierModel":"claude-haiku-4-5-20251001","classifierPromptVersion":"v3","cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.00403,"patchAvailable":true,"disclosureDate":"2026-09-01T20:38:22.000Z","capecIds":null,"crossRefCount":0,"attackSophistication":"moderate","impactType":["integrity","confidentiality","availability"],"aiComponentTargeted":"framework","llmSpecific":false,"classifierConfidence":0.85,"researchCategory":null,"atlasIds":["AML.T0010"]}}